CVE-2026-111602: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVE-2026-111602 describes a sensitive information exposure vulnerability (CWE-200) in the LatePoint Appointment Booking Plugin for WordPress. In all versions up to and including 5.7.4, unauthenticated attackers can enumerate UUID prefixes via the steps__load_step AJAX endpoint using the 'params (customer[uuid])' parameter. This allows extraction of customer data including first name, last name, email address, phone number, and notes. The vulnerability is conditional on the plugin being configured with guest checkout mode enabled, which disables login-based authentication.

An unauthenticated attacker can access personally identifiable information (PII) of all customers stored in the plugin's database, including names, email addresses, phone numbers, and notes. This exposure compromises customer privacy but does not affect integrity or availability of the system. The CVSS score of 3.7 (low severity) reflects the limited impact and the requirement for a specific configuration to exploit.

No official patch or fix is currently documented. Users should verify if a vendor advisory or update is available for this vulnerability. Until a fix is released, it is recommended to avoid using the guest checkout mode ('Disable ability to login') configuration or restrict access to the AJAX endpoint to authenticated users only. Monitor the vendor's communications for an official patch or update.